Business CCTV GDPR Checklist for UK Small Businesses

Business CCTV GDPR checklist: the essentials

Before recording starts, name the organisation responsible for the personal data and the role accountable for each decision. Keep an evidence record covering purpose, lawful basis, views, audio, notices, access, retention and requests. The ICO's limited-system checklist is a useful starting point, but it must describe your premises rather than a generic installation.

Separate an unresolved legal decision from an unfinished technical task. A privacy lead may need to justify monitoring a loading bay; an installer may need to demonstrate that a neighbouring window is masked in the saved footage. Neither task substitutes for the other. Record outstanding actions and the event that will prompt a review, such as changed opening hours, new cameras or a different hosting supplier.

Choose a lawful purpose and proportionate camera views

Describe the problem and the evidence you need. Protecting a stockroom entrance does not automatically justify filming a staff rest area or every part of the pavement. Consider less intrusive measures, including better entrance management, before widening surveillance. Where legitimate interests is the proposed lawful basis, the organisation must assess necessity and the effect on people; the installer should not select a legal basis on its behalf.

Give the installer an approved coverage plan with areas that must remain excluded. Compare it with actual live views and recorded playback, including relevant lighting conditions. Confirm whether a privacy mask affects the recording, exported clips and remote access, not just the screen used at handover. The ICO operational guidance supports proportionate setup; the equipment's actual behaviour still needs checking.

Staff monitoring, neighbouring space and audio

Assess staff monitoring explicitly rather than assuming a security label or staff signature resolves privacy concerns. Explain the purpose and access arrangements to affected people. Treat microphones as a separate collection method: they may capture conversations outside the visible scene. Disable unnecessary audio and document any reason for keeping it, with suitable privacy advice where the proposed use is intrusive.

When a DPIA is required

The ICO requires a data protection impact assessment where processing is likely to result in high risk. Purpose, scale, sensitive locations and technology matter. Record the assessment decision and the person responsible for it. Do not use camera count as a compliance shortcut, and do not treat this installation checklist as the DPIA itself.

What must business CCTV signs and notices contain?

Place clear notice where people can understand that recording takes place before entering the monitored area. Identify the operating organisation, explain the purpose and show how fuller privacy information can be obtained. Check entrances used by visitors, staff and deliveries rather than relying on one sign inside the building. A camera symbol cannot explain every aspect of processing on its own.

The fuller privacy notice should match how the system actually works, including who handles enquiries and what happens to recordings. Assign responsibility for keeping it accurate when views, suppliers or use change. Do not publish private administrator details or access credentials on signs. Transparency supports accountable operation; it does not make unnecessary recording proportionate.

Do you need to pay the ICO data protection fee?

Assess the organisation's fee liability using the current ICO guidance, including exemptions and special categories. This is a data protection fee for the controller, not a separate camera licence or an installer charge. The comparison below records the published annual tiers checked on 1 October 2026. Use turnover or staff criteria as stated and assess tier 1 before tier 2.

The ICO describes a £5 direct debit discount, giving £47 or £73 for the two SME tiers. Keep the self-assessment result and renewal responsibility with the organisation's records. Fees are regulatory amounts, not TRACEFORM service prices. Recheck them if the business's circumstances or official fee guidance change.

How long can a business keep CCTV footage?

The ICO does not prescribe a universal minimum or maximum retention period. Choose a period that addresses the documented purpose and explain why it is necessary. Decide who authorises changes and how automatic deletion is checked. A recorder's maximum capacity or an internet example is not a retention justification.

Preserve relevant incident footage separately where there is a justified need, limiting it to the material required. Record why it is held and when that reason should be reviewed. Routine recordings should continue to follow the agreed deletion process. Include backups and hosted copies in the discussion so removing a clip from the local recorder is not mistaken for deleting every copy.

How should you handle CCTV footage requests?

Give requests a clear owner and log receipt promptly. Locate potentially relevant recordings before routine deletion removes them, then assess identity, the scope of the request and other people's information. Current ICO subject access guidance, updated 16 July 2026, requires a response without undue delay and normally within one month.

A qualifying extension can allow up to two further months, with notification within the first month. Reasonably required clarification can pause the clock under the guidance's conditions; identity and fee conditions can also affect timing. These are not general reasons to defer an inconvenient request. Keep the deadline assessment and explanation with the response record and seek privacy advice where exemptions or redaction are disputed.

Police disclosures and footage containing other people

Assess disclosures for their particular purpose and recipient. Preserve and export the relevant segment rather than sharing broad access to unrelated recordings. Other people appearing in a clip may require redaction or another careful disclosure assessment. Crime prevention is not a blanket exemption and does not justify publishing identifiable footage on social media.

Installation handover: who owns each compliance task?

The controller approves purpose, access, retention and rights procedures. The installer demonstrates the agreed technical settings and provides usable operating instructions. A hosting or maintenance supplier's access and contractual role must be clarified separately. Decide who owns administrator accounts, who can revoke access and how temporary installer access ends.

Demonstrate playback, retrieval, export and deletion using suitable test material without exposing personal footage in a public worksheet. Record the evidence location, responsible role and outstanding action. A signed handover confirms the agreed technical checks, not a legal guarantee. Use the business CCTV installation service for site scope and the cost guide for quotation inclusions; this page does not price installations.